External risk intelligence

Webreaper Damselfly Authentication Bypass Allows Full Administrator Control.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111626

The vulnerability exists in an API controller (/api/*) within a web server application. APIs are commonly deployed as internet-facing services or web application backends. Because the vulnerability allows unauthenticated access to these endpoints, including user management functions, it is likely that such an interface would be exposed or reachable in a network-connected deployment.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Webreaper Damselfly software through version 4.5.3, which allows unauthenticated access to its API routes. This could enable attackers to create administrator accounts or reset user passwords, potentially leading to a complete takeover of the affected system.

Unauthenticated access to software APIs.
Critical impact: enables admin creation and password resets.
Confirm relevance and exposure of this software.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by directly interacting with the application's API endpoints over the network. Since the necessary authorization checks are commented out in the code, an unauthenticated attacker can send specially crafted requests to these API routes to bypass authentication. This allows them to perform actions like creating new administrator accounts or resetting any user's password, ultimately leading to complete system control.

No authentication required.
Exploits commented-out authorization attributes.
Leads to full administrative control.

Live Threat

Current exploitation, exposure, and threat context

An authentication bypass vulnerability exists in the API, allowing unauthenticated attackers to access routes such as `/api/*`. This could lead to unauthorized creation of administrator accounts or password resets for any user, granting attackers full control over the system when supported by the advisory.

Administrator accounts and user passwords at risk.
Unauthenticated access to API endpoints.
Complete system control by attackers.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Rebreaper Damselfly authentication bypass vulnerability requires immediate attention from teams responsible for web applications and APIs. The first critical step is to identify all instances of Rebreaper Damselfly, determine their network exposure, and confirm their business criticality. Once accountable owners are identified, remediation can be planned based on risk, potentially involving vendor coordination if direct patching is not immediately feasible.

Identify system owners and affected assets.
Verify network exposure and business criticality.
Plan risk-based remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Webreaper Damselfly?

Webreaper Damselfly is a web server application designed to manage digital media. It includes specialized components for user management and interacts with web clients through API endpoints. The software is used to organize and serve content, meaning it functions as a backend service that processes incoming web requests to perform administrative tasks.

What is the vulnerability in CVE-2026-111626?

This CVE represents a CWE-306 vulnerability, which is a Missing Authentication for Critical Function weakness. In Damselfly, the code responsible for verifying user permissions for API routes was left commented out. Because these security checks are inactive, the application fails to verify the identity of anyone making requests to the /api/ namespace, allowing unauthorized access.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending direct HTTP requests to the application's /api/ routes over the network. Because the underlying controller authorization attributes are inactive, no credentials or valid login tokens are required to reach these functions. Simply browsing to or sending a request to these paths allows the application to execute sensitive operations, regardless of the attacker's actual permissions.

Is my Damselfly instance at risk?

According to Halo Surface Signal, this vulnerability is likely to affect your environment if your Damselfly instance is network-connected. Since the flaw resides in an API controller, any instance reachable over a network—particularly one that is internet-facing—is susceptible to unauthorized access. If your deployment uses these API endpoints, they are reachable by external or internal actors.

What steps should I take if I run this software?

Your priority is to identify where Damselfly is running in your network and determine its accessibility. Since this flaw allows full control through user management actions, restrict network access to these API routes immediately. Work with your technical team to locate all instances and prepare for remediation, such as applying future updates or implementing access controls to block unauthenticated traffic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.